fix(security): extend /proc read block to auxv and pagemap

Follow-up to the cherry-pick of @AhmetArif0's #32238. auxv is the
glaring miss alongside maps/smaps — it exposes AT_RANDOM (stack canary)
and AT_BASE/AT_PHDR (program/interpreter load addresses), which is a
direct ASLR oracle on par with /proc/*/maps.

pagemap exposes virtual→physical address translations on systems that
expose it to userspace (depends on CAP_SYS_ADMIN / kernel config) — same
address-leak class.

Adds both to the same endswith tuple and to the existing parametrized
test, keeping the fragile-suffix pattern consistent with the rest of the
guard. A regex/set refactor across all /proc leak vectors (pagemap,
syscall, stack, wchan, kallsyms) is worth a follow-up but out of scope
for closing this immediate gap.

tests/tools/test_file_read_guards.py

@@ -93,7 +93,7 @@ class TestDevicePathBlocking(unittest.TestCase):
         self.assertFalse(_is_blocked_device_path("/proc/self/fd/3"))
 
     def test_proc_sensitive_pseudo_files_blocked(self):
-        """environ/cmdline/maps under /proc/<pid> must be blocked (issue #4427)."""
+        """environ/cmdline/maps (and maps variants) under /proc/<pid> must be blocked (issue #4427)."""
         for path in (
             "/proc/self/environ",
             "/proc/12345/environ",
@@ -101,6 +101,18 @@ class TestDevicePathBlocking(unittest.TestCase):
             "/proc/99/cmdline",
             "/proc/self/maps",
             "/proc/1/maps",
+            "/proc/self/smaps",
+            "/proc/12345/smaps",
+            "/proc/self/smaps_rollup",
+            "/proc/99/smaps_rollup",
+            "/proc/self/numa_maps",
+            "/proc/1/numa_maps",
+            "/proc/self/auxv",
+            "/proc/12345/auxv",
+            "/proc/self/pagemap",
+            "/proc/99/pagemap",
+            "/proc/self/mem",
+            "/proc/12345/mem",
         ):
             self.assertTrue(_is_blocked_device(path), f"{path} should be blocked")
 

tools/file_tools.py

@@ -137,10 +137,17 @@ def _is_blocked_device_path(path: str) -> bool:
         ("/fd/0", "/fd/1", "/fd/2")
     ):
         return True
-    # /proc/*/environ, /proc/*/cmdline, /proc/*/maps can leak secrets,
-    # command-line args, and memory layout from the host process (issue #4427)
+    # /proc/*/environ, /proc/*/cmdline, /proc/*/maps (and the maps variants
+    # smaps, smaps_rollup, numa_maps) can leak secrets, command-line args, and
+    # memory layout (ASLR bypass) from the host process (issue #4427).
+    # /proc/*/auxv contains AT_RANDOM (stack canary) and AT_BASE/AT_PHDR
+    # (interpreter/program load addresses) — direct ASLR oracle.
+    # /proc/*/pagemap exposes virtual→physical translations — address leak.
+    # /proc/*/mem exposes raw process memory; block it as defense-in-depth even
+    # though it requires address knowledge to exploit usefully.
     if normalized.startswith("/proc/") and normalized.endswith(
-        ("/environ", "/cmdline", "/maps")
+        ("/environ", "/cmdline", "/maps", "/smaps", "/smaps_rollup",
+         "/numa_maps", "/auxv", "/pagemap", "/mem")
     ):
         return True
     return False